Title: Bitcoincore 0.21.2 - SHA256SUMS.asc Post by: harlequininja on October 29, 2022, 08:44:50 AM Hi,
I tried to verify the SHA256SUMS.asc form Bitcoincore 0.21.2. I get Code: gpg: Signature made Wed 29 Sep 2021 06:26:46 BST When I fetch the Key form hkps://keys.openpgp.org I get Code: gpg: key 90C8019E36C2E964: new key but contains no user ID - skipped I understand that it has something to do with the RSA-format but I can't figure out how to receive the proper public key in order to verify the SHA256SUMS. I also collected some public keys form contributors of this version but it didn't work. Help is very much appreciated. Title: Re: Bitcoincore 0.21.2 - SHA256SUMS.asc Post by: nc50lc on October 29, 2022, 09:22:20 AM It's one of those older versions that are exclusive to bitcoincore.org right?
For that, you need to import Wladimir's key for Bitcoin Core binary releases: github.com/bitcoin-core/bitcoincore.org/blob/master/keys/laanwj-releases.asc (http://github.com/bitcoin-core/bitcoincore.org/blob/master/keys/laanwj-releases.asc) Title: Re: Bitcoincore 0.21.2 - SHA256SUMS.asc Post by: harlequininja on October 29, 2022, 09:51:39 AM Yes it is an older version straight form the bitcoincore.org server
https://bitcoincore.org/bin/bitcoin-core-0.21.2/ (https://bitcoincore.org/bin/bitcoin-core-0.21.2/) Should I replace the SHA256SUMS.asc with the laanwj-releases.asc? Because I looked up the Wladimir's key here: https://github.com/bitcoin/bitcoin/blob/master/contrib/builder-keys/keys.txt (https://github.com/bitcoin/bitcoin/blob/master/contrib/builder-keys/keys.txt) Code: 71A3B16735405025D447E8F274810B012346C9A6 Wladimir J. van der Laan (laanwj) I successfully received his key but still couldn't verify the SHA256SUMS.asc file. ??? Title: Re: Bitcoincore 0.21.2 - SHA256SUMS.asc Post by: nc50lc on October 29, 2022, 10:07:02 AM No, it's the signing key of SHA256SUMS.asc for v0.21.2.
You should "manually" import that other key from bitcoincore.org's repository, the one I've linked which is the RSA key 90C8019E36C2E964: Code: 01EA5486DE18A882D4C2684590C8019E36C2E964 Wladimir J. van der Laan (Bitcoin Core binary release signing key) Title: Re: Bitcoincore 0.21.2 - SHA256SUMS.asc Post by: harlequininja on October 29, 2022, 10:44:57 AM I copied the content
Code: -----BEGIN PGP PUBLIC KEY BLOCK----- and created a publickey.txt file which I imported via Code: $ gpg --import publickey.txt Did work nicely and I also could verify the SHA256SUM.asc by using Code: $ gpg --verify SHA256SUMS.asc Thanks a lot! But what I still don't get is, does this mean the original releasae-key (https://github.com/bitcoin-core/bitcoincore.org/blob/master/keys/laanwj-releases.asc (https://github.com/bitcoin-core/bitcoincore.org/blob/master/keys/laanwj-releases.asc)) isn't a part of the pgp-publickey-libraries anymore? Do you know the reason for it? Title: Re: Bitcoincore 0.21.2 - SHA256SUMS.asc Post by: BlackHatCoiner on October 29, 2022, 12:19:11 PM I had imported Wladimir's public key in the past, but it's now expired. Tried to verify SHA256SUMS.asc, it did have a good signature.
Code: $ gpg --verify SHA256SUMS.asc I re-imported it, with the provided github link, and there wasn't a problem. That's the latest commit by laanwj: Quote from: https://github.com/bitcoin-core/bitcoincore.org/commit/ca7a649c50ed244682b4e3b3237ec13d6a148640 Change the expiration to 2024. The key is no longer being used for new releases, but letting it expire now would be inconvenient because there may still be another 0.21.x release, and, people may still want to verify older releases. This should be enough for all releases signed with it to be EOL. After that, it can be removed from the site completely. I hope this does answer your last question. Title: Re: Bitcoincore 0.21.2 - SHA256SUMS.asc Post by: harlequininja on October 30, 2022, 05:18:57 PM Cheers, that explains everything!
|